MAL-2025-148797 Malicious code in transport-postgres-slidev-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d1df68b6c3a3deed16b7ba403f00479cb352e025b7e61894e351acaafe0136 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-chromedriver-flare-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47c39fe3bba442aca2cda6e7c18a2ffa40c87639f81952046f80fbff313e601f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-staged-gridsome-less-loader-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98a7c959df4560a355bfcd68e15080007566b2e99e74162477598c165db3994c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140370 Malicious code in canopus-proxima-yaml-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dab40b667df69aafddc22f108f2d07a25f78edad369a93fe46cb65cacb2f989a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootstrap-arcturus-helios-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3947299fa044b87eb92f53308452eb8cfc390a2fdb66832a2c0fa232ac75a0f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-postgres-perseus-draco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118c548fba36106c65ab5a4047e37654324785d2a7b091b8c04a743d9c47bc8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tethys-cypress-optimize-css-assets-webpack-plugin-enif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f105b3dd515bd0a46c837e65d9a353f5440a1ee4d2bb6b1800b64e2f8b2cb81f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149414 Malicious code in webpack-yakutsk-tailwindcss-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25825cc6a045d46e8a6a37b1471e8c3cecd611ebb0c739ebb6da4d03503de226 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11996

The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fuideleteimage and fuideleteallimages functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site...

CVE-2025-42894

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

Responsive Hotel Site roomdel.php File SQL Injection Vulnerability

Responsive Hotel Site is a responsive hotel website. Responsive Hotel Site suffers from a SQL injection vulnerability that stems from the /admin/roomdel.php file mishandling the ID parameter and failing to properly validate and filter user input. An attacker can exploit this vulnerability to obta...

EulerOS 2.0 SP12 : gnutls (EulerOS-SA-2025-2326)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject...

Malicious code in surya-rendang61-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1f544f92b819743395e0336b8cc22f6750d1f2ca7fe6b652b9159ba270a011 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zain-buburayam62-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7723bb5a72fd7e0a81dc591e75c3d60a5edb35e163ec716aeac3bce55b25d964 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-134692 Malicious code in joko-tahutek75-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba6f02bd027b639303e8943316f6a4354f6d85e879b6db8a74c8e451268ae2ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137254 Malicious code in tender_turkey_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50a0d8b8be4acd830e9984937b3321f2d96184d16cf5ab79e58abda141b2c0d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-136348 Malicious code in putra-tapai80-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 544615cfe38106ae25b8c2f9e72a16aad05bf257dcb67e2f0505c03e73d30ed2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-135835 Malicious code in nina-tahu5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 556a30aa609daacbc39cc1095e119f2b10c855795fc70db7bf86244f68aaad82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137086 Malicious code in sticky_alpaca_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db375daddf7527cf109416b84b0726510d039d23e1257e9a9987a5091cc667ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lina-nasipecel89-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8fff31eb76768d5ab5e899f2d1039f2469bfd0f7cdaef16b2c1f9b5d794720 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...